Cybersecurity in Government Contracts

Cybersecurity in government contracts refers to the security requirements, certifications, audit obligations, and contractual terms that IT vendors must satisfy when supplying hardware, software, or services to Indian government organisations. These requirements have grown significantly since 2020 as India's government IT infrastructure has expanded, cyber threats have escalated, and the regulatory framework has matured.

What is Cybersecurity in Government Contracts?

The primary authority for cybersecurity requirements in Indian government contracts is CERT-In (Computer Emergency Response Team India), operating under MeitY. CERT-In issues guidelines on information security for government organisations, covering network architecture, patch management, incident reporting, and vendor security obligations. All government IT vendors must comply with CERT-In's Information Security Guidelines for Central Government Organisations as a contractual baseline.

The key security frameworks referenced in government IT tenders include ISO/IEC 27001 (Information Security Management System), which vendors must be certified against to supply to most central and state government departments. Beyond ISO 27001, tenders for systems handling classified or sensitive data may require vendors to hold security clearance from intelligence agencies (IB clearance for some categories) and may exclude vendors from countries considered security risks.

The CERT-In Directions 2022 are particularly important, they mandate that any company providing digital services in India must report cybersecurity incidents to CERT-In within 6 hours, maintain logs of all ICT systems for 180 days within India, and deploy STQC-tested products for specific security equipment. These obligations apply to government vendors and were a significant compliance burden when first introduced.

For defence and national security IT contracts, the security requirements go further: source code escrow, no foreign nationals accessing classified systems, physical security of data centres, and end-to-end encryption of all data in transit and at rest are standard. Vendors working on defence IT systems must hold appropriate security clearances and allow MoD's technical intelligence directorate periodic access for security audits.

Penetration testing (ethical hacking) of delivered systems is increasingly mandated. Before commissioning, government IT systems must undergo penetration testing by a CERT-In-empanelled security testing vendor. The vendor list is maintained at CERT-In's website. If penetration testing reveals critical vulnerabilities, the SI must remediate them before the system can go live, at their own cost.

Why it matters for bidders

Security compliance is not optional for government IT, it is a contract eligibility condition. Companies without ISO 27001 certification, or with a history of data breaches, will fail the technical evaluation for significant government IT contracts. Investing in ISO 27001 certification before pursuing government IT contracts is a prerequisite, not an afterthought.

The data localisation requirement (government data must stay in India) means government IT vendors using cloud infrastructure must confirm their cloud provider's data centres are physically in India and the contractual terms prevent data transfer to foreign servers. AWS India, Microsoft Azure India, and Google Cloud India regions all host government-compliant data centre infrastructure, but the vendor must ensure contractual localisation commitments.

For smaller IT companies, STQC testing certification for security products, encryption devices, firewalls, intrusion detection systems, is the entry credential for supplying these categories. STQC is MeitY's testing and certification body, and its certification is recognised by all government procurement entities.

Example

A cybersecurity company wants to supply Next-Generation Firewall (NGFW) appliances to the Army's IT network. The tender requires: product tested and certified by STQC, ISO 27001:2022 certification for the company, source code review by CERT-In-empanelled labs, and no hardware components from "untrusted vendors" per MeitY's guidelines on critical information infrastructure. The company's NGFW is STQC-certified and uses components sourced exclusively from trusted vendors. The company holds ISO 27001 certification. It submits the STQC certificate, ISO certificate, and a declaration on component sourcing with the bid. After technical evaluation confirms compliance, the company's bid proceeds to financial evaluation.

Key rules / thresholds

CERT-In's Directions of April 2022 require all entities (including government IT vendors) to report cyber incidents within 6 hours. ISO 27001 certification is mandatory for vendors in government IT tenders above Rs 10 crore in most state and central government RFPs. STQC certification is mandatory for security products (firewalls, intrusion detection systems, antivirus products) supplied to government. All government IT contracts must include a Data Protection Agreement (DPA) compliant with the Digital Personal Data Protection Act 2023 before the system handles personal data.